2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play
Size 11.3MB
Sample260804-tyfazsal3s
SHA256 22b35793ae1eb22f99564eb5c41b8f77309c29c63e723e746f5e495700576199
MD5 238dbfd03cb04d850fbcfdfd6d707c20
SHA1 e75aef8cf258b7a095896c992e538e36a04f84bb
SHA512 af085dacd87b2a97d6124119b6a7eaeb1028945f96669ca61be5bc28facd280f3d4877f23f70556e2de5e119d514d998903cf3024a38c2969ade60c6234c3977
SSDEEP 98304:z9ihzzLZpooNT6c/iGChGs3pbG3jdsg4gOR/1XhDkF3O3sKCuDjGe54Fi:5s/unKB+xRNxe3O3NW8Si
TLSH
T167C6CF026E0717A8DC9EB6FC702C052500E9AC5F8FA849EA1FE7CD58D72E2A55061F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play

File Explorer

2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play

.exe 11.3MB

2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play

IMPHASH 3abd89bd31a4209cc5fd3c802ea5a9db
SHA256 22b35793ae1eb22f99564eb5c41b8f77309c29c63e723e746f5e495700576199
MD5 238dbfd03cb04d850fbcfdfd6d707c20
SHA1 e75aef8cf258b7a095896c992e538e36a04f84bb
SHA512 af085dacd87b2a97d6124119b6a7eaeb1028945f96669ca61be5bc28facd280f3d4877f23f70556e2de5e119d514d998903cf3024a38c2969ade60c6234c3977
SSDEEP 98304:z9ihzzLZpooNT6c/iGChGs3pbG3jdsg4gOR/1XhDkF3O3sKCuDjGe54Fi:5s/unKB+xRNxe3O3NW8Si
TLSH
T167C6CF026E0717A8DC9EB6FC702C052500E9AC5F8FA849EA1FE7CD58D72E2A55061F5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

bc:9b:22:2d:5c:fc:23:48:c0:0d:8a:56:12:35:bd:5f:9e:38:dd:22

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,ST=Beijing,C=CN

Chains

Jan 14, 2009

CN=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,ST=Beijing,C=CN

Serial Number

0a:f9:9d:85:f0:a1:1e:ff:98:4d:ca:48:4e:28:99:a4

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 14, 2007 - Jul 12, 2010

Minor OS version

Major OS version

Entry point

120567

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalAlloc GlobalFree GlobalLock GlobalUnlock MulDiv SizeofResource InitializeCriticalSection GetCurrentThreadId FreeResource LockResource LoadResource FindResourceW DeleteCriticalSection LoadLibraryW CreateDirectoryW ReadFile SetLastError GetCommandLineW GetFileAttributesW MultiByteToWideChar GetLastError GlobalFlags GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryW CreateProcessW CopyFileW WideCharToMultiByte VirtualQuery HeapFree HeapReAlloc HeapAlloc GetProcessHeap ResetEvent LeaveCriticalSection WriteConsoleW HeapSize CreateFileW FlushFileBuffers GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW ReadConsoleW GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetFileType SetFilePointerEx DecodePointer WriteFile GetStdHandle GetCommandLineA GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RaiseException RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount EnterCriticalSection TryEnterCriticalSection IsDebuggerPresent CreateThread WaitForSingleObject SetEvent FindFirstFileW FindNextFileW FindClose GetModuleFileNameW GetTickCount VirtualAlloc LoadLibraryExA SetEndOfFile FreeLibrary VirtualFree DeleteFileW CreateEventW ExitProcess OpenEventW SetWaitableTimer CreateWaitableTimerW TerminateProcess QueryDosDeviceW OpenProcess GetCurrentProcess Process32NextW CloseHandle Process32FirstW CreateToolhelp32Snapshot GetCurrentProcessId GetProcAddress GetModuleHandleW GetTempPathW GetSystemDirectoryW GetSystemTimeAsFileTime GetWindowsDirectoryW

user32

GetWindowTextLengthW MsgWaitForMultipleObjects keybd_event TranslateMessage GetWindowTextW PeekMessageW DispatchMessageW WaitForInputIdle MonitorFromWindow FindWindowExW GetWindowThreadProcessId ShowWindowAsync MessageBoxW GetMessageW ReleaseDC GetDC LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW EnumWindows GetWindowLongW SendMessageW LoadStringW

gdi32

GetDeviceCaps GetObjectW DeleteObject DeleteDC CreateCompatibleDC SetDIBColorTable CreateDIBSection SelectObject

comdlg32

GetFileTitleW

advapi32

RegCreateKeyExW RegSetValueExW RegCloseKey RegOpenKeyExW

shell32

SHGetSpecialFolderPathW

ole32

CoInitializeEx CreateStreamOnHGlobal CoUninitialize CoCreateInstance CoInitialize

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked

psapi

GetProcessImageFileNameW

ws2_32

WSACleanup

gdiplus

GdipGetImageHeight GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImage GdiplusStartup GdipBitmapLockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipFree GdipGetImageWidth GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdiplusShutdown GdipGetImagePixelFormat GdipSetCompositingMode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

comctl32

psapi

ws2_32

gdiplus

generic